Nothing teaches a visitor to click accept blindly faster than being asked the same question on every visit. The banner that reappears daily trains exactly the behavior consent law exists to prevent: reflexive agreement without reading. Remembering consent is therefore not a convenience feature. Done right, it is what makes the first consent meaningful.
Done wrong, memory creates its own problems. Consent remembered forever, across changed policies and changed laws, is not consent at all. This post walks through how consent memory should work: how long it lasts, what should trigger a fresh ask, and the edge cases, devices, jurisdictions, and withdrawals, where remembered consent quietly breaks.
How consent memory works
When a visitor chooses, the banner writes a first-party cookie holding the consent state, the categories chosen, the banner version, and the date. On later visits the site reads that cookie before deciding anything: tags follow the stored state and the banner stays hidden. First-party matters. A consent stored in a third-party context is a consent that browser tracking prevention will delete for you, on its own schedule.
Set the cookie lifetime deliberately, not by default. Six to twelve months is the common range, and several European regulators have pointed at six months as a reasonable re-ask interval. Whatever you choose, the date in your privacy notice and the date in the cookie should be the same date. Auditors check exactly this, because it is easy to check.
When to ask again
Three events should retire a remembered consent. Expiry, when the stored date passes your stated lifetime. Material change, when you add a category, a significant vendor, or a new purpose: the visitor consented to a specific arrangement, and a different arrangement needs a new answer. And jurisdiction shift, when the returning visitor now arrives from a place with stricter rules than the banner they originally answered.
What should not trigger a re-ask is a copy tweak, a color change, or a new marketing manager's preference. Version your banner properly: material changes increment the version and re-prompt, cosmetic changes do not. A site that re-asks monthly for no reason teaches visitors that the banner is weather, not a question.
Where memory breaks
Devices are the first crack. Consent lives in one browser on one device, so the same person is remembered on their laptop and unknown on their phone. That is legally acceptable, consent attaches to the browsing context, but the experience should acknowledge it rather than pretending otherwise. Logged-in accounts can carry consent across devices, and for account-heavy sites that sync is worth building.
The second crack is deletion. Visitors clear cookies, browsers cap cookie lifetimes, and private browsing forgets everything. A share of returning visitors will always see the banner again. Keep that flow fast and identical to the first ask, and never treat a forgotten consent as a rejected one or, worse, an accepted one. Absence of a record means ask, with defaults off.
Changing a remembered choice
The test of consent memory is not how well it hides the banner. It is how easily a visitor can change their mind. A persistent privacy choices link in the footer, reopening the same preference panel the banner offered, is the standard pattern. Burying the settings inside a privacy policy page, or requiring an email to support, converts a remembered yes into a locked door.
Log changes with the same care as the original choice: the timestamp, the new state, the version. A visitor who tightened their settings in March and finds marketing tags firing in April has the single most damaging consent story a site can produce. Memory is a promise. The settings link and the log are how you keep it.
Frequently asked questions
How long should a site remember consent?
Six to twelve months is the typical range, with several European regulators treating six months as a reasonable point to ask again. Pick a period, state it in your privacy notice, and set the cookie lifetime to match. A mismatch between the notice and the cookie is an easy audit failure.
When must returning visitors be asked again?
When their stored consent expires, when your processing materially changes, such as new categories or significant new vendors, or when they return from a jurisdiction with stricter requirements than the banner they answered. Cosmetic banner changes should not trigger a re-ask.
Why do some returning visitors see the banner again?
Because consent lives in a browser cookie. Clearing cookies, switching devices or browsers, private browsing, and browser-imposed cookie lifetime caps all erase the memory. Treat a missing record as no consent yet: show the banner, with non-essential tags off by default.
How should visitors change a remembered consent choice?
Through a persistent privacy choices link, usually in the footer, that reopens the same preference panel as the banner. The change should take effect immediately, be logged with a timestamp like the original choice, and never require contacting support.